[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Recommended Cybersecurity Requirements for Consumer-Grade Router Products:

## A.3.6. Data Protection 1

access to home networks. They also have robust networking capabilities, giving them utility for a wide range of attacks. Other router product components present their own risks. Backends may aggregate data from one or more customers, making them attractive targets for attackers. Mobile applications may be installed in relatively hostile environments due to malware and other vectors of attack. ISO 31000 [ISO31000] is a foundational resource that developers should use for risk management. NIST's Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy , SP 800-37 Rev. 2 [SP800-37r2] may also be useful guidance for risk management.

Recommended Cybersecurity Requirements for Consumer-Grade Router Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

.......................................................................75                                                                                |
| 5.4.1.
Business Associate Contracts or Other Arrangements (§ 164.314(a)).......................................77                                                                                |
| 5.4.2. Requirements for Group Health Plans (§ 164.314(b))................................................................79                                                                                |
| 5.5.1. Policies and Procedures (§ 164.316(a))......................................................................................81                                                                                |
| 5.5.2. Documentation (§ 164.316(b))...................................................................................................83                                                                                |
| References.......................................................................................................................................85                                                                                |
| Appendix A. List of Symbols, Abbreviations, and Acronyms...............................................................87                                                                                |
| Appendix B. Glossary .......................................................................................................................91                                                                                |
| Appendix C.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements provide? (Part 5)

[Assistant]
heir respective organizations. ## Summary of Changes

The following table details the changes between NISTIR 7511 Revision 4 and NISTIR 7511 Revision 5, which are incorporated in the present document.
| Date       | Type        | Change                                                                                | Page Number   |
|------------|-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| 04/20/2018 | Editorial   | Sorted the items listed in Appendix A in alphabetical order                                                                                | 37            |
| 04/20/2018 | Editorial   | Corrected the section number referenced by SCAP.V.2500.1                                                                                | 22            |
| 04/20/2018 | Substantive | Updated the SCAP.T.2860.1 to match the requirement SCAP.R.2860                                                                                | 24            |
| 04/20/2018 | Editorial   | Updated the status of the SP800-126r3, SP800-126A, and SP800-70 to 'Final'                                                                                | 43            |
| 04/20/2018 | Substantive | Replaced 'Schematron style sheets' with 'Schematron schemas' to match ISO 19757-3 terminology throughout the document                                                                    | n/a           |
| 04/20/2018 | Substantive | Updated SCAP.T.1300.2 to include both XSD and Schematron schema for XCCDF component validation.

Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Research Report_ User Perceptions of Smart Home Privacy and Security:

Another said that her biggest concerns were financial: 'bank account because, in that case, you could lose money and they actually wouldn't bring it back. Identity purposes, I don't want my credit being a GLYPH<11> ected because then they can get a whole host of other issues going on' (P17\_A) .

Research Report_ User Perceptions of Smart Home Privacy and Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols provide? (Part 2)

[Assistant] ara *«• 9 -, j wnjta '*11 vf,r .r'M ^ ''- w/ / ' *^- • , ri s* >*< ^ 4^SlblW > i Il6 *> » i VI- 7- vwiislt.-^-' '•v '•t^'' ;i*''«4*« ' -r v '*/* •' fliei aiwiiiJWiffc M M: ^HSisjwraH ;3|l^) 5rsi's?j&yr ## Table of Contents | | | | Page | | | | | |--------------|---------------------------------------------|--------------|--------|---------------------------------------------|---------------------------------------------|---------------------------------------------|---------------------------------------------| | Foreword | Foreword | | iii | | | | | | Introduction | Introduction | | vii | | | | | | SDNS | Secure Data Network Security Protocol 3 | System (SP3) | 1 | Secure Data Network Security Protocol 3 | Secure Data Network Security Protocol 3 | Secure Data Network Security Protocol 3 | Secure Data Network Security Protocol 3 | | SDNS | Secure Data Network Security Protocol 4 | System (SP4) | 39 | Secure Data Network Security Protocol 4 | Secure Data Network Security Protocol 4 | Secure Data Network Security Protocol 4 | Secure Data Network Security Protocol 4 | | SDNS | Secure Data Network System Message Security | Protocol | 63 | Secure Data Network System Message Security | Secure Data Network System Message Security | Secure

Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations:

When determining the extent to which the organization automates ISCM, organizations consider potential efficiencies of process standardization that may be gained with automation, and the potential value (or lack of value) of the automated security- related information from a risk management perspective. Additionally, organizations consider intangibles such as the potential value of personnel reassignment and more comprehensive situational awareness.

This section describes the roles and responsibilities of key participants involved in an organization's ISCM program. Widely varying missions and organizational structures may lead to differences in naming conventions for ISCM-related roles and how specific responsibilities are allocated among organizational personnel (e.g., multiple individuals filling a single role or one

Chief Information Officer (CIO). The CIO leads the organization's ISCM program. The CIO ensures that an effective ISCM program is established and implemented for the organization by establishing expectations and requirements for the organization's  ISCM program; working closely with authorizing officials to provide funding, personnel, and other resources to support ISCM; and maintaining high-level communications and working group relationships among organizational entities.

Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series:

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8459/final, including related content, potential updates, and document history.

Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to The NIST Cybersecurity Framework (CSF) 2.0:

agement is essential for addressing privacy risks related to the loss of the confidentiality, integrity, and availability of individuals' data. For example, data breaches could lead to identity theft.
However, privacy risks can also arise by means that are unrelated to cybersecurity incidents.

The NIST Cybersecurity Framework (CSF) 2.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to An Introduction to Information Security:

3.2.1 Automated Tools

Even for small multiuser systems, manually reviewing security features may require significant resources.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992:

- Establish configuration control for security purposes (Priority A).
- -Supercomputer sites are high priority.
- -Distribute/support use of automated security management tools (e.g. COPS).
- Establish a security perimeter protection capability (Priority B) (e.g. filters, control gateways, Simple Network Management Protocol (SNMP)).
- Establish security audit information collection and review capability (Priority B).

5. use of privacy enhanced mail for sensitive communication for administration and security officers, Kerberos, Distributed System Security Architecture (DASS);
6. raising the level of attention with respect to configuration and operation of security relevant portions of the system within a particular site, particularly the domain name service; and
7. a potpourri of administrative and operational considerations - development of security policies at each center, education of people, careful configuration of the cryptographic parts of each site, fire drills so that timely and effective action can take place when a intrusion is discovered to be in progress, and spending time keeping abreast of the technologies.

Crocker inquired about the memory requirements needed to run Kerberos. Schiller stated the binary file 'rlogin' is required along with a few configuration files. This resides in about 50-60 Kbytes of memory on a VAX. The DES layer can be optimized to gain additional space. At one point, Kerberos was running on a 256K PC. It will presently run on a laptop computer.

Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations:

3.2.3 DEVELOP ISCM ARCHITECTURE

Organizations determine how the information will be  collected and delivered within and between the tiers as well as external to the organization.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control:

List of Abbreviations and Acronyms .........................................................51                                    | Appendix A. List of Abbreviations and Acronyms .........................................................51                                    |                                                                                |
| Appendix B. Glossary........................................................................................................55                | Appendix B. Glossary........................................................................................................55                |                                                                                |
| Appendix C. Additional Resources ..................................................................................58                         | Appendix C. Additional Resources ..................................................................................58                         |                                                                                |
| List of Tables                                                                                | List of Tables                                                                                | List of Tables                                                                                |
| Table 1. Baseline Profile for the Identify Function......................................................................10                   | Table 1.

Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook:

This National Institute of Standards and Technology Interagency Report (NISTIR) presents the National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook . The Handbook provides NASA's overall approach to automated information systems security including: program goals and objectives, assignment of responsibilities, risk assessment, foreign national access, contingency planning and disaster recovery, awareness training, procurement, certification, planning, and special considerations for microcomputers. | Paraaraoh   |                                                       |                                                       | Pace   |
|-------------|-------------------------------------------------------|-------------------------------------------------------|--------|
|             | c. | Personnel Screening                                   | 3-6    |
|             | d. | Access Protection and Accountability                  | 3-6    |
|             | e. | Compliance Assurance                                  | 3-6    |
|             | f                                                     | Contingency and Disaster Recovery Plans               | 3-7    |
|             | g-                                                    | Approval of Methodologies                             | 3-7    |
| 303         | Risk                                                  | Assessment Process                                    | 3-7    |
| 304         | Protective Measures to Prevent Misuse and Abuse       | Protective Measures to Prevent Misuse and Abuse       | 3-10   |
| 305         | Certification                                         | Process                                               | 3-10   |
|             | a. | New or Modified Applications                          | 3-11   |
|             | b.

National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Computer Security Division 2003 Annual Report:

Computer  Associates, the Internet Security Task Force, Microsoft, the SANS Institute, and  the  Carnegie  Mellon  University CERT Coordination Center. ASSET was first developed and released in 2002.
The  past  year  has  seen  several  developments, including  a  FISMA  reporting  template  and  an updated  ASSET  v1.4  being  released  in  early October  2003. The  CSD  held  several  training sessions during 2003, and will continue to hold training  sessions  in  2004. More  updates  are under development that will result in a new 2.0 version being released in early 2004.

Computer Security Division 2003 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case:

## Supply Chain

Raw materials are utilized to support the continuous operation of the manufacturing process. Raw materials are typically supplied through a long-term contract established with suppliers and are transported to the facility on a regular basis.

Westman is committed to protecting its trade secrets, including product development, manufacturing processes, product quality, and supply chain management.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0:

by external attackers or the unauthorized access or use of data by employees. Figure 2 shows these types of cybersecurity-related privacy events as the overlap between privacy and cybersecurity risks.
| Function                                | Category                                                                                |                                                                                | Subcategory   |
|-----------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| appropriate data processing safeguards.

NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study provide?

[Assistant]
## NISTIR 8420

## Federal Cybersecurity Awareness Programs

A Mixed Methods Research Study

Julie Haney Jody Jacobs Susanne Furman Fernando Barrientos

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8420

<!-- image -->

## NISTIR 8420

## Federal Cybersecurity Awareness Programs

A Mixed Methods Research Study

Julie Haney Jody Jacobs Susanne Furman Fernando Barrientos Information Access Division Information Technology Laboratory

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8420

March 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8420 48 pages (March 2022)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8420

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide for Developing Security Plans for Federal Information Systems:

risk and local conditions including organization-specific security requirements, specific threat information, costbenefit analyses, the availability of compensating controls, or special circumstances.
Common security controls, which is one of the tailoring considerations, must be identified prior to system security plan preparation in order to identity those controls covered at the agency level, which are not system-specific. These common security controls can then be incorporated into the system security plan by reference.

Guide for Developing Security Plans for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to General Server Security:

| Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1                                                                                | Executive Summary..............................................................................................................ES-1   |
|---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
| 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cryptographic Algorithms and Key Sizes for Personal Identity Verification provide? (Part 5)

[Assistant]
osure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

Cryptographic Algorithms and Key Sizes for Personal Identity Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN):

|                                                                                | Introduction ...........................................................................................................................1   | Introduction ...........................................................................................................................1   |
|-----------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Purpose and Objectives..................................................................................................

Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.10 (NIST 3.4.10)?

[Assistant]
According to Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN):

3.4.10, 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories:

| General Support System        | An interconnected set of information resources under the same direct management control that shares common functionality. It normally includes hardware, software, information, data, applications, communications, and people. [OMB Circular A-130, Appendix III]                                                                                |
|-------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| High-Impact System            | An information system in which at least one security objective (i.e., confidentiality, integrity, or availability) is assigned a FIPS 199 potential impact value of high.

Guide for Mapping Types of Information and Information Systems to Security Categories


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS):

------------|
| PR:4.6   | AT-2   | Federal CKMS users and managers shall receive training about the security policies relevant to the FCKMS and the use of the FCKMS in accordance with those policies.
|
| PA:4.1   |        | The FCKMS Security Policy should specify the following: a) The names of the organization(s) adopting the policy; b) Who (person, title or role) is authorized to approve/modify the policy, c) The impact-levels of the information that is specified in and controlled by the policy, d) The primary data and key/metadata protection services (i.e., data confidentiality, data integrity, source authentication) that are to be provided by the FCKMS, e) The security services (e.g., personal accountability, personal privacy, availability, anonymity, unlinkability, unobservability) that can be supported by the FCKMS, f) Sensitivity and handling restrictions for keys and associated metadata, g) The algorithms and all associated parameters to be used for each impact-level and with each protection service, h) The expected maximum lifetime of keys and metadata for each cryptographic algorithm used, i) The acceptable methods of user/role and source authentication for each information impact-level to be protected by a key and its associated metadata, j) The backup, archiving and recovery requirements for keys and metadata at each information impact-level, k) The roles to be supported by the FCKMS, l) The access control and physical security requirements for the FCKMS's keys and metadata for each impact- level, m) The means and rules for recovering keys and metadata, and n) The communication protocols to be used when protecting sensitive data, keys, and metadata. |

A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to SRI International_ Improving the Security of Your UNIX System:

3.3.2       | Checklists                           |   32 |
| 3. 3.3.2 Checklists

Checklists can be a useful tool for discovering unauthorized changes made to system directories.

SRI International_ Improving the Security of Your UNIX System


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.4 (NIST 3.5.4)?

[Assistant]
According to Standard Security Label for GOSIP_ an Invitational Workshop:

3.5.4 This model maps well to the existing document based world.

Standard Security Label for GOSIP_ an Invitational Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions:

This  Standard  specifies  the  Secure  Hash  Algorithm-3  (SHA-3)  family  of  functions  on binary  data.  Each  of  the  SHA-3  functions  is  based  on  an  instance  of  the  KECCAK algorithm that NIST selected as the winner of the SHA-3 Cryptographic Hash Algorithm Competition.  This  Standard  also  specifies  the  KECCAKp family  of  mathematical permutations, including the permutation that underlies KECCAK, in order to facilitate the development of additional permutation-based cryptographic functions.

(modes) of the permutation.  In  this  Standard,  the  permutation  is  specified  as  an  instance  of  a family of permutations, called KECCAKp ,  in  order  to  provide  the  flexibility  to  modify  its  size and security parameters in the development of any additional modes in future documents.

The four SHA-3 hash functions differ slightly from the instances of KECCAK that were proposed for  the  SHA-3  competition  [3].  In  particular,  a  two-bit  suffix  is  appended  to  the  messages,  in order  to  distinguish  the  SHA-3  hash  functions  from  the  SHA-3  XOFs,  and  to  facilitate  the development  of  new  variants  of  the  SHA-3  functions  that  can  be  dedicated  to  individual application domains.

SHA-3 Standard_ Permutation-Based Hash and Extendable-Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to A Threat Analysis on UOCAVA Voting Systems:

One of the greatest difficulties is the time required to use traditional mail as a mechanism to distribute and receive election material (absentee ballot requests, blank absentee ballots, etc.). In general, the delivery times for postal and military mail to citizens overseas vary greatly depending where the citizen is located. It can take 5 to 10 days for most mail to be delivered to overseas citizens not in the military [25]; and 10 to 14 days for mail to be delivered to military personnel [24]. In addition, uniformed military and overseas citizens may not be at a given physical location for an extended period of time. Given that some jurisdictions finalize their ballots only 30-45 days before an election, using mail to distribute, receive and return election information can be difficult. In some cases the delivery times to distribute blank ballots and return them to local election officials could exceed the window of time between ballot printing and Election Day. This does not take into account the time required for election officials to process and handle blank ballots, or the time required for voters to fill out their ballots and drop them in the mail. Items in the mail are handled by a large number of people. In theory, any of the individuals charged with delivering a registration/request form could open the envelope to obtain personal information. However, this threat is substantially reduced by a variety of factors. Most postal carriers undergo some form of background check. Furthermore, it would be extremely difficult for a small number of malicious individuals to obtain a large amount of information. Most postal employees would only handle a small number of registration/request materials.

A Threat Analysis on UOCAVA Voting Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Asset Management:

UTOMATED CHANGE IMPLEMENTATION The organization employs automated mechanisms to implement changes to the current information system baseline and deploys the updated baseline across the installed base.
|
| CM-3(4)                  | CONFIGURATION CHANGE CONTROL | SECURITY REPRESENTATIVE The organization requires an information security representative to be a member of the [Assignment: organization-defined configuration change control element]. |
| CM-3(5)                  | CONFIGURATION CHANGE CONTROL | AUTOMATED SECURITY RESPONSE The information system implements [Assignment: organization-defined security responses] automatically if baseline configurations are changed in an unauthorized manner. |
| CM-3(6)                  | CONFIGURATION CHANGE CONTROL | CRYPTOGRAPHY MANAGEMENT The organization ensures that cryptographic mechanisms used to provide [Assignment: organization-defined security safeguards] are under configuration management. |

Automation Support for Security Control Assessments_ Software Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines for Securing Wireless Local Area Networks (WLANs):

t other networks that are accessible through it, such as internal wired networks reachable from the WLAN. An important principle of WLAN security is to separate WLANs with different security profiles.
For example, there should be separate WLANs for external (guest, etc.) and internal use. Devices on an organization's external WLAN should not be able to connect through that WLAN to devices on another of the organization's WLANs. This helps to protect the organization's other networks and devices from external devices and users. Organizations often set up external WLANs primarily to provide Internet access to visitors; such WLANs should be architected so

Guidelines for Securing Wireless Local Area Networks (WLANs)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Audit and Accountability?

[Assistant]
According to Personal Identity Verification (PIV) of Federal Employees and Contractors:

PIV  enrollment  records SHALL maintain  an  auditable  sequence  of  enrollment  events  to facilitate  binding  an  applicant  to  multiple  transactions  that  might  take  place  at  different times  and  locations. 6 These  records  are  generally  stored  as  part  of  the  cardholder's  PIV identity  account,  either  as  part  of  the  issuer's  IDMS  or  through  links  to  records  in  other related  systems  (e.g.,  card  management  systems).

- Maintain  appeal  procedures  for  those  who  are  denied  a  credential  or  whose credentials  are  revoked.
- Ensure  that  only  personnel  with  a  legitimate  need  for  access  to  PII  in  the  PIV system  are  authorized  to  access  the  PII,  including  but  not  limited  to  information and  databases  maintained  for  registration  and  credential  issuance. 19
- Coordinate  with  appropriate  department  or  agency  officials  to  define  consequences for  violating  privacy  policies  of  the  PIV  system.
- Ensure  that  the  technologies  used  in  the  department  or  agency's  implementation  of the  PIV  system  allow  for  continuous  auditing  of  compliance  with  stated  privacy policies  and  with  practices  governing  the  collection,  use,  and  distribution  of information  in  the  operation  of  the  program.
- Utilize  security  controls  described  in  [SP  800-53]  to  accomplish  privacy  goals, where  applicable.
- Ensure  that  the  technologies  used  to  implement  PIV  sustain  and  do  not  erode privacy  protections  relating  to  the  use,  collection,  and  disclosure  of  PII.  Agencies MAY choose  to  deploy  PIV  Cards  with  electromagnetically  opaque  holders or  other  technology  to  protect  against  any  unauthorized  contactless  access  to information  stored  on  a  PIV  Card.

Personal Identity Verification (PIV) of Federal Employees and Contractors


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Computer Security Division 2007 Annual Report:

53 | | Computer Security Division Publications - FY 2007 | 54 | | Ways to Engage Our Division and NIST | 56 |

Computer Security Division 2007 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Media Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| FAMILY                            | FAMILY                               |
|-----------------------------------|--------------------------------------|
| Access Control                    | Media Protection                     |
| Awareness and Training            | Personnel Security                   |
| Audit and Accountability          | Physical Protection                  |
| Configuration Management          | Risk Assessment                      |
| Identification and Authentication | Security Assessment                  |
| Incident Response                 | System and Communications Protection |
| Maintenance                       | System and Information Integrity     |

17  The Audit and Accountability, Maintenance, Media Protection, and Physical Protection families do not contain enhanced security requirements at this time.

## 3.8   MEDIA PROTECTION

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Contingency Planning Guide for Federal Information Systems:

13 The SDLC refers to the scope of activities associated with a system, encompassing the system's initiation, development and acquisition, implementation, operation, and maintenance, and ultimately its disposal that instigates another system initiation. The SDLC approach is discussed in depth in NIST SP 800-64, Security Considerations in the Information System Development Life Cycle .  An overview of contingency planning and the SDLC is provided in Appendix F.

Although some changes may be quite visible, others will require additional analysis.  When a significant change occurs, the BIA should be updated with the new information to identify new contingency requirements or priorities.  As new technologies become available, preventive controls may be enhanced and recovery strategies may be modified.  Finally, plan maintenance should be continued as the information system passes through the Disposal phase of its life cycle to ensure that the plan accurately reflects recovery priorities and concurrent processing changes.

Disposal Phase . Contingency considerations should not be neglected because an information system is retired and another system replaces it.  Until the new system is operational and fully tested (including its contingency capabilities), the original system's ISCP should be maintained in a ready state for implementation.  As legacy systems are replaced, they may provide a valuable capability as a redundant system if a loss or failure of the new information system should occur.  In some cases, equipment parts (e.g., hard drives, power supplies, memory chips, or network cards) from hardware that has been replaced can be used as spare parts for new operational equipment.  In addition, legacy information systems can be used as test systems for new applications, allowing potentially disruptive system flaws to be identified and corrected in a nonproduction environment.

Contingency Planning Guide for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Metrics and Methodology for Hardware Security Constructs:

|   ID | Description                            |
|------|----------------------------------------|
|   26 | Leveraging Race Conditions             |
|  113 | Interface Manipulation                 |
|  114 | Authentication Abuse                   |
|  122 | Privilege Abuse                        |
|  124 | Shared Resource Manipulation           |
|  176 | Configuration/Environment Manipulation |
|  188 | Reverse Engineering                    |
|  192 | Protocol Analysis                      |
|  233 | Privilege Escalation                   |
|  441 | Malicious Logic Insertion              |
|  624 | Hardware Fault Injection               |

In CAPEC, standard-level attack patterns are a sub-group of meta-level attack patterns that focus on a particular attack methodology or technique. For example, a standard attack pattern can describe a subversion of code-signing mechanisms, which falls under the meta-level attack pattern of privilege escalation. Code signature facilities are used by several programming languages to verify the identity of code and link it to its designated privileges in an appropriate environment. Subverting this mechanism can be instrumental to an attacker escalating privilege. Thus, a standard-level attack pattern describes a specific mechanism for escalating

Metrics and Methodology for Hardware Security Constructs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Approaches for Federal Agencies to Use the Cybersecurity Framework provide? (Part 4)

[Assistant]
n  determining  the  risks  that  are  relevant  to  its mission throughout the operational lifecycle and apply an appropriate type and degree of resources to treat those risks to an acceptable level.
Examples in this publication will demonstrate the use of the Cybersecurity Framework, the NIST Risk Management Framework (RMF), and other models to evaluate and report agency goals and progress and to inform tailoring activities for managing cybersecurity risk appropriately. Use of a comprehensive cybersecurity risk-based approach, as demonstrated  through  these  examples,  supports  agencies'  activities  to  meet  their  concurrent obligations to comply with the requirements of FISMA and Executive Order (EO) 13800. ## Keywords

Cybersecurity Framework; Federal Information Security Management Act (FISMA); Risk Management Framework (RMF); Enterprise Risk Management; security and privacy controls. ## Acknowledgments

The authors would like to thank our advisors and reviewers including Nahla Ivy, Donna Dodson, Adam Sedgewick, Amy Mahn, Matt Scholl, Kevin Stine, Kelley Dempsey, Ron Ross, Jim Foti, Mat Heyman, and Matt Smith. ## Supplemental Content

For additional information on NIST's cybersecurity programs, projects and publications, visit the Computer Security Resource Center, csrc.nist.gov. Information on other efforts at NIST and in the Information Technology Laboratory (ITL) is available at www.nist.gov and www.nist.gov/itl. ## Document Conventions

The phrase 'federal agencies' in this publication means those agencies responsible for nonnational security-related information in federal systems. FISMA refers to the Federal Information Security Management Act of 2002, as amended. The Federal Information Security Management Act of 2002 was updated through the Federal Information Security Modernization Act of 2014 [1] [2].

Approaches for Federal Agencies to Use the Cybersecurity Framework


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Derived PIV Application and Data Model Test Guidelines:

3.2.2 - CHANGE REFERENCE DATA Card Command |
| DTR-06. 3.2.2 - CHANGE REFERENCE DATA Card Command |

| DTR No:         | DTR Description                                                                                | Spec. 3.2.2 - CHANGE REFERENCE DATA Card Command |
| DTR-06.

Derived PIV Application and Data Model Test Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 1_ Overview:

| Attack Step | Attacker Action | Defender Action | |-------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1) Gain Internal Entry | The attacker is outside the target boundaries and seeks entry.

Automation Support for Security Control Assessments_ Volume 1_ Overview


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to CMVP Approved Authentication Mechanisms_ CMVP Validation Authority Requirements for ISO_IEC 19790 Annex E and ISO_IEC 24579 Section 6.17:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

CMVP Approved Authentication Mechanisms_ CMVP Validation Authority Requirements for ISO_IEC 19790 Annex E and ISO_IEC 24579 Section 6.17


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Transitioning to the Security Content Automation Protocol (SCAP) Version 2 provide? (Part 5)

[Assistant] 11 | | Appendix B-Acronyms and Abbreviations............................................................14 Appendix C-Glossary | ..............................................................................................15 | | Appendix D-References ..........................................................................................16 | | | List of Figures | List of Figures | | Figure 1: SCAP v2 Architectural Components and Protocols ..................................4 | Figure 1: SCAP v2 Architectural Components and Protocols ..................................4 | | Figure 2: SCAP v2 Architecture: Endpoint Posture Information Collection ............9 | Figure 2: SCAP v2 Architecture: Endpoint Posture Information Collection ............9 | | Figure 3: SCAP v2 Architecture: Vulnerability Information Sharing.......................10 | Figure 3: SCAP v2 Architecture: Vulnerability Information Sharing.......................10 | | Figure 4: SCAP v2 Architecture: Vulnerability Analysis Capabilities.....................11 | Figure 4: SCAP v2 Architecture: Vulnerability Analysis Capabilities.....................11 | | Figure 5: SCAP v2 Architecture: Configuration Setting Checklist Assessment....12 | Figure 5: SCAP v2 Architecture: Configuration Setting Checklist Assessment....12 | ## 1 Introduction This document defines a set of design goals for the next major revision of the Security Content Automation Protocol (SCAP), SCAP v2.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Security Guidelines for Storage Infrastructure:

Storage technology, just like its computing and networking counterparts, has evolved from traditional storage service types, such as block, file, and object. Specifically, the evolution has taken two directions: one along the path of increasing storage media capacity (e.g., tape, Hard Disk Drives, solid-state drives (SSD)) and the other along the architectural front, starting from direct-attached storage (DAS) to the placement of storage resources in networks accessed through various interfaces and protocols to cloud-based storage resource access, which provides a software-based abstraction over all forms of background storage technologies. Accompanying the architectural evolution is the increase in management complexity, which subsequently increases the probability of configuration errors and associated security threats. This document provides an overview of the evolution of the storage technology landscape, current security threats, and the resultant risks. The main focus of this document is to provide a comprehensive set of security recommendations that will address the threats. The recommendations span not only security management areas that are common to an information technology (IT) infrastructure (e.g., physical security, authentication and authorization, change management, configuration control, and incident response and recovery) but also those specific to storage infrastructure (e.g., data protection, isolation, restoration assurance, and encryption). - Data protection
- Isolation
- Restoration assurance
- Encryption

| Executive Summary...................................................................................................... | Executive Summary...................................................................................................... | Executive Summary......................................................................................................

Security Guidelines for Storage Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Information Security Handbook_ A Guide for Managers:

- The Federal Information Security Management (FISMA) Act is the primary legislation governing federal information security programs, building upon earlier legislation through added emphasis on the management dimension of information security. - -FISMA delegates to the National Institute of Standards and Technology (NIST) the responsibility to develop detailed information security standards and guidance for federal information systems, with the exception of national security systems. - -FISMA designates to OMB the oversight of federal agencies' information security implementation. - -FISMA provides a comprehensive framework for securing federal government IT resources, including defining key federal government and agency roles and responsibilities, requiring agencies to integrate information security into their capital planning and enterprise architecture processes, requiring agencies to conduct annual information security reviews of all programs and systems, and reporting the results of those reviews to OMB. 2
- OMB Circular A-130, Management of Federal Information Resources , Appendix III, Security of Federal Automated Information Resources , establishes a minimum set of controls to be included in federal automated information security programs, assigns federal agency responsibilities for the security of automated information, and links agency automated information security programs and agency management control systems. 3
- Homeland Security Presidential Directive 12 (HSPD-12), released in August 2004, specifies a "policy for a common identification standard for all Federal employees and contractors." 4 HSPD-12 intends to increase identification security and interoperability by standardizing the process to issue a Federal employee or contractor an identification credential, and also by specifying the electronic and physical properties of the credential itself. The HSPD-12 credential is known as the Personal Identity Verification card.

Information Security Handbook_ A Guide for Managers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to A Review of U.S. and European Security Evaluation Criteria:

Two types of requirements are delineated for secure processing: (1) specific security feature requirements and; (2) assurance requirements. The latter enable evaluation personnel to determine if the required features are present and functioning as intended.

The Orange Book forms the basis upon which the National Computer Security Center (NCSC) conducts its commercial computer security evaluation process. This process is focused on commercially produced and supported general-purpose operating system products that meet the needs of government departments and agencies. The evaluation is aimed at off-the-shelf products and is completely separate from any considerations of overall system performance, potential applications, or processing environments. The evaluation can provide a key input to a computer system security approval /accreditation . However, it does not constitute a complete computer system security study. A complete study must consider additional factors dealing with the system in its unique environment, such as its proposed security mode of operation, specific users, applications, data sensitivity, physical and personnel security, administrative security and communications security

The Orange Book and Red Book criteria do not address all of the security concerns that arise when one actually deploys a system, whether it consists of a single computer or is composed of multiple computer and network products from different vendors. Procedural, physical and personnel safeguards enter into overall system security, and these are only partially addressed by these two documents. System security requires a thorough analysis of the system in question, taking into account not only the ratings of products that might be used to build the system, but also the threats directed against the system. Based on this analysis a security architecture can then be proposed and developed.

A Review of U.S. and European Security Evaluation Criteria


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.4 (NIST 3.1.4)?

[Assistant]
According to PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance):

3.1.4 Virtual Contact Interface

| Purpose            | Validates that the PUT DATA command cannot be issued through the VCI.

PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines_ Developing Cybersecurity and Privacy Concept Mappings:

| Logical Component                     | Component's Function                                                                      | Function's Relationships to CSF 1.1 Subcategories (and Relationship Properties)                                                                             | Relationship Explanation                                                                                |
|---------------------------------------|-------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Certificate Authority (CA)            | Issues and signs certificates as needed. | Supports (example of) PR.AC- 1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes | The fact that a credential is signed by a trusted CA provides a mechanism that may be used for enabling the credential to be verified and revoked. |
| Certificate Authority (CA)            | Issues and signs certificates as needed. | Supports (integral to) PR.AC- 6: Identities are proofed and bound to credentials and asserted in interactions                                               | If the device credential is an X.509 certificate (e.g., an IDevID) that is signed by a CA, this certificate binds the device's credential to the device's identity.

Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines_ Developing Cybersecurity and Privacy Concept Mappings


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Implementation of DevSecOps for a Microservices-based Application with Service Mesh:

pplications with the architecture and code types described above. The benefits of this approach for high security assurance and for enabling continuous authority to operate (C-ATO) are also discussed.
CI/CD pipelines are workflows for taking the developer's source code through various stages, such as building, functional testing, security scanning for vulnerabilities, packaging, and deployment supported by automated tools with feedback mechanisms. For the purpose of this document, the entire set of source code involved in the application environment is classified into five code types:

Implementation of DevSecOps for a Microservices-based Application with Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface:

3.3.1. 3.3.1.

Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does The Keyed-Hash Message Authentication Code (HMAC) provide? (Part 3)

[Assistant]
ed by the message sender to produce a value (the MAC) that is formed by condensing the secret key and the message input. The MAC is typically sent to the  message  receiver  along  with  the  message.
The  receiver  computes  the  MAC  on  the received message using the same key and HMAC function as were used by the sender, and compares the result computed with the received MAC. If the two values match, the message  has  been  correctly  received,  and  the  receiver  is  assured  that  the  sender  is  a member of the community of users that share the key. 4. Approving Authority. Secretary of Commerce. 5. Maintenance  Agency. Department  of  Commerce,  National  Institute  of  Standards and Technology, Information Technology Laboratory (ITL). 6. Applicability. This Standard is applicable to all Federal departments and agencies for the protection of sensitive unclassified information that is not subject to Title 10 United States Code Section 2315 (10 USC 2315) and that is not within a national security system as  defined  in  Title  44  United  States  Code  Section  3502(2)  (44  USC  3502(2)). The adoption and use of this Standard is available to private and commercial organizations. 7. Specifications. Federal Information Processing Standard (FIPS) 198-1, The KeyedHash Message Authentication Code (HMAC) (affixed). 8. Implementations. The authentication mechanism described in this Standard may be implemented  in  software,  firmware,  hardware,  or  any  combination  thereof. NIST  has developed a Cryptographic Module Validation Program that will test implementations for conformance  with  this  HMAC  Standard. Information  on  this  program  is  available  at http://csrc.nist.gov/groups/STM/index.html. Agencies are advised that keys used for HMAC applications should not be used for other purposes. 9. Other Approved Security Functions.

The Keyed-Hash Message Authentication Code (HMAC)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Conformance Assessment of Transport Layer Security Implementations:

- (1) Data Integrity,
- (2) Data Confidentiality,
- (3) Data Origination Authentication, and
- (4) Access Control.

The SP4 standard identifies other security functions on which it depends. These functions include key management, security management, and cryptography. Key management is needed to establish and maintain keying material used by SP4; security management is needed for event reporting and auditing; and cryptography (i.e., employment of specific cryptographic algorithms) is needed to support Data Integrity, Data Confidentiality, and Authentication services. These functions are normally collocated in an end-system, with an SP4 entity.

computer system operating environment. The objective of the security evaluation is to perform a technical assessment of the trust properties. Three general security issues that must be addressed are: the confidentiality of the data, the integrity of the data and the system, and the availability of service. The goal or main requirement is to assure that the system behaves according to an organization's security requirements that, in turn, reflect the defined security policy of the organization. To guarantee that this requirement is met, the security functionality of an implementation must work correctly and effectively.

Conformance Assessment of Transport Layer Security Implementations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Derived PIV Application and Data Model Test Guidelines:

ERNAL AUTHENTICATE), to authenticate an entity to the token (EXTERNAL AUTHENTICATE), and to perform a mutual authentication between the token and an entity external to the token (MUTUAL AUTHENTICATE).
| • [SP800-157], Appendix B.2 - Derived PIV Application Token Command Interface • [SP800-73], Part 2, Section 3.2.4 - GENERAL AUTHENTICATE Card Command |

| DTR No:         | DTR Description                                                                                | Spec.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Notional Supply Chain Risk Management Practices for Federal Information Systems:

| | 3.1 Roles and Responsibilities for Information and Communication Technology Supply Chain Risk Management _____________________________________________ 12 | 3.1 Roles and Responsibilities for Information and Communication Technology Supply Chain Risk Management _____________________________________________ 12 | 3.1 Roles and Responsibilities for Information and Communication Technology Supply Chain Risk Management _____________________________________________ 12 | | 3.2 Information and Communication Technology Supply Chain Risk Management Implementation Process______________________________________________ 14 | 3.2 Information and Communication Technology Supply Chain Risk Management Implementation Process______________________________________________ 14 | 3.2 Information and Communication Technology Supply Chain Risk Management Implementation Process______________________________________________ 14 | | 4.1 Uniquely Identify Supply Chain | Elements, Processes, and Actors _____________ | 28 | | 4.2 | Limit Access and Exposure within the Supply Chain _______________________ | 31 | | 4.3 | Establish and Maintain the Provenance of Elements, Processes, Tools, and Data | 34 | | 4.4 | Share Information within Strict Limits ___________________________________ | 38 | | 4.5 | Perform Supply Chain Risk Management Awareness and Training ___________ | 45 | | 4.6 | Use Defensive Design for Systems, Elements, and Processes __________________ | 47 | | 4.7 | Perform Continuous Integrator Review __________________________________ | 58 | | 4.8 | Strengthen Delivery Mechanisms _______________________________________ | 61 |

Notional Supply Chain Risk Management Practices for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments provide? (Part 3)

[Assistant]
l official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2023-09-08

## How to Cite this NIST Technical Series Publication:

Chandramouli R, Butcher Z (2023) A Zero-Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-207A. https://doi.org/10.6028/NIST.SP.800-207A

## Author ORCID iDs

Ramaswamy Chandramouli: 0000-0002-7387-5858

## Contact Information

sp800-207A-comments@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

One of the basic tenets of zero trust is to remove the implicit trust in users, services, and devices based only on their network location, affiliation, and ownership. NIST Special Publication 800207 has laid out a comprehensive set of zero trust principles and referenced zero trust architectures (ZTA) for turning those concepts into reality. A key paradigm shift in ZTAs is the change in focus from security controls based on segmentation and isolation using network parameters (e.g., Internet Protocol (IP) addresses, subnets, perimeter) to identities. From an application security point of view, this requires authentication and authorization policies based on application and service identities in addition to the underlying network parameters and user identities.

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Transitioning the Use of Cryptographic Algorithms and Key Lengths:

SP 800-131A was originally published in January 2011 and revised in 2015. This revision updates the transition guidance provided in the 2015 version; these changes are listed in Appendix B. The most significant difference is the schedule for retiring the Triple Data Encryption Algorithm 5 (TDEA), the inclusion of safe-prime groups for finite field Diffie-

- Washington, D.C.), Federal Information Processing Standards Publication (FIPS) 198-1, July 2008. https://doi.org/10.6028/NIST.FIPS.198-1
- [FIPS 202] National Institute of Standards and Technology (2015) SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions. (U.S. Department  of  Commerce,  Washington,  D.C.),  Federal  Information Processing Standards Publication (FIPS) 202. https://doi.org/10.6028/NIST.FIPS.202
- [IG X.Y] Implementation Guidance for FIPS 140-2 and the Cryptographic Module Validation Program, where X.Y is the section number. - [SP 800-38A] Dworkin  MJ  (2001) Recommendation  for  Block  Cipher  Modes  of Operation: Methods and Techniques . (National Institute of Standards and Technology,  Gaithersburg,  Maryland),  NIST  Special  Publication  (SP) 800-38A, December 2001. https://doi.org/10.6028/NIST.SP.800-38A
- [SP 800-38B] Dworkin  MJ  (2016) Recommendation  for  Block  Cipher  Modes  of Operation:  the  CMAC  Mode  for  Authentication . (National  Institute  of Standards  and  Technology,  Gaithersburg,  Maryland),  NIST  Special Publication (SP) 800-38B, May 2005 (includes updates as of 10/06/2016). https://doi.org/10.6028/NIST.SP.800-38B
- [SP 800-38C] Dworkin  MJ  (2007) Recommendation  for  Block  Cipher  Modes  of Operation:  the  CCM  Mode  for  Authentication  and  Confidentiality . (National Institute of Standards and Technology, Gaithersburg, Maryland), NIST Special Publication (SP) 800-38C, May 2004 (includes updates as of 07/20/2007).

Transitioning the Use of Cryptographic Algorithms and Key Lengths


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook:

ers must be specially designed, developed, and implemented over months or years. Once an automated system is fully operational, the options available to provide computer security are somewhat limited.
However, if security is designed into an automated system, the safeguard options are vastly increased and the safeguard costs over the life of the system are substantially reduced. This is true for computer hardware, system software, and application software. Therefore, it is important for NASA managers to ensure that security is appropriately addressed in all phases of the life cycle for automated systems, especially in the early planning stages. - d. History . In the past, NASA computer security guidance was provided through the following:
- (1) NASA Handbook (NHB) 2410.1, "Information Processing Resources Management," April 1985.

National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Computer Security Division 2005 Annual Report:

We also invite public and private organizations to submit their information security practices to be considered for inclusion on the list of practices maintained on the Web site. Policies and procedures may be submitted to us in any area of information security, including accreditation, audit trails, authorization of processing, budget planning and justification, certification, contingency planning, data integrity, disaster planning, documentation, hardware and system maintenance, identification and authentication, incident  handling  and  response, life cycle, network  security, personnel  security, physical and environmental protection, production

To keep pace with the rate of change in emerging technologies, we  conduct  a  large  of  amount  of research  in  existing  and  emerging  technology areas. Some  of  the  many  topics  we  research include  smart  card  infrastructure  and  security, wireless and mobile device security, voice over IP security issues, digital forensics tools  and methods, access control and authorization management, Internet Protocol security, intrusion detection systems, quantum information system security and quantum cryptography, and vulnerability analyses. Our research helps fulfill specific needs by the Federal government that would not be easily or reliably filled otherwise.

A uthentication of an individual's identity is a fundamental  component  of  physical  and logical  access  control  processes. When  individuals attempt to access security-sensitive buildings, computer  systems, or  data, an  access control  decision  must  be  made. An  accurate determination  of identity is  an  important component  in  making  sound  access  control decisions.

Computer Security Division 2005 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Security Segmentation in a Small Manufacturing Environment support CMMC certification?

[Assistant]
According to Security Segmentation in a Small Manufacturing Environment:

<!-- image -->

## NIST Cybersecurity White Paper NIST CSWP 28

## Security Segmentation in a Small Manufacturing Environment

Dr. Michael Powell National Cybersecurity Center of Excellence National Institute of Standards and Technology

John Hoyt Aslam Sherule Dr. Lynette Wilcox The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.CSWP.28

April 6 , 2023

<!-- image -->

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology (NIST), nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. ## NIST Technical Series Policies

Copyright, Fair Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2023-03-3 0

## How to Cite this NIST Technical Series Publication:

Powell M, Hoyt J, Sherule A, Wilcox L (202 3 ) Security Segmentation in a Small Manufacturing Environment. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Cybersecurity White Paper (CSWP) NIST CSWP 28. https://doi.org/10.6028/NIST.CSWP.28

## Author ORCID iDs

Dr. Michael Powell: 0000-0002-3922-7435 John Hoyt: 0000-0002-0783-7036 Aslam Sherule: 0000-0002-2003-3817 Dr. Lynette Wilcox: 0000-0003-1246-6505

## Contact Information

manufacturing\_nccoe@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

Manufacturers are increasingly targeted in cyber-attacks.

Security Segmentation in a Small Manufacturing Environment

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide to Attribute Based Access Control (ABAC) Definition and Considerations:

| Executive Summary ................................................................................................................... | Executive Summary ................................................................................................................... | Executive Summary ................................................................................................................... | vii   |
|----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|-------|
| 1. Introduction ............................................................................................................................ | 1. Introduction ............................................................................................................................ | 1. Introduction ............................................................................................................................ | 1     |
| 1.1                                                                                | Purpose and Scope ....................................................................................................... | Purpose and Scope ....................................................................................................... | 1     |
| 1.2                                                                                | Audience .........................................................................................................................

Guide to Attribute Based Access Control (ABAC) Definition and Considerations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Approximate Matching_ Definition and Terminology:

3.3.3 Robustness

Robustness is a measure of the ability of an approximate matching algorithm to find correlation among  related  objects  in  the  presence  of  noise  and  routine  transformations. 3.3.3.

Approximate Matching_ Definition and Terminology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control provide? (Part 5)

[Assistant]
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.
As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Computer Security Division 2013 Annual Report:

entity Management                                                                                | ..............................................................
42 |
| Personal Identity Verification (PIV) and FIPS 201 Revision Efforts ...................................................................... | 42                                                                |
| PIV Program Test Cards ........................................................... | 43                                                                |
| NIST Personal Identity Verification Program (NPIVP)                                                                                | .................... 43                                           |
| Research in Emerging Technologies                                                                                | ........................................ 44                       |
| Cloud Computing and Virtualization........................................... | 44                                                                |
| Mobile Device Security                                                                                | ............................................................ 46   |
| Strengthening Internet Security .............................................. | 47                                                                |
| USGv6: A Technical Infrastructure to Assist IPv6 Adoption............ | 47                                                                |
| Access Control and Privilege Management.............................. | 48                                                                |
| Access Control and Privilege Management Research                                                                                | ..................

Computer Security Division 2013 Annual Report